[Honeypot Alert] User-Agent Field XSS Attacks

The highlighted data in the Apache access_log holds the User-Agent field token data from the request. In this case, the attacker has inserted some Javascript code that would use the window.location function to cause the web browser to request the txt2pic.com website. After checking out that location we find the following:

This server responds with a 302 redirect and sends the user onto the imagegenerator.org website. So, this attack scenario presumably is simply a method of SPAM linking to increase web traffic hits.

Recommendation

While this attack instance was relatively harmless, the take away from this example is that you must take care if you are ever utilizing any type of web-based log analytic processes. If you are ever using a web browser to review log file data, this type of an attack may trigger. See CAPEC-106: Cross Site Scripting through Log Files for more info.